Attribute resolver dependency question/issue

[Tom Poage]

Greetings,

Ran across an issue where an attribute (eduPersonScopedAffiliation) is
released on some authentications (first log line below) and not others
(second line). IdP 2.3.3. Log lines from same server.

> 06:36:48.187 - INFO [Shibboleth-Audit:970] - 20120502T133648Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_7e52370bd1ae8de4417fbd797f989447|https://XXX.edu/|urn:mace:shibboleth:2.0:profiles:saml2:sso|urn:mace:incommon:ucdavis.edu|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_885fefeb71e10800b71b2d201f4e5a81|loginid|urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified|eduPersonPrincipalName,transientId,surname,eduPersonScopedAffiliation,givenName,email,displayName,|DE22T...||
> 06:38:35.263 - INFO [Shibboleth-Audit:970] - 20120502T133835Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_7ab58a59dbde89e01c811b7bb41ba47f|https://XXX.edu/|urn:mace:shibboleth:2.0:profiles:saml2:sso|urn:mace:incommon:ucdavis.edu|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_873e17b5ab439c0bcd23bffbe9cb76f1|loginid|urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified|eduPersonPrincipalName,transientId,surname,givenName,email,displayName,|OTN2TTF...||

Our eduPersonAffiliation is stored in LDAP, but not scoped affiliation;
ePSA relies on ePA.

I had assumed specifying sourceAttributeID creates an implicit
dependency to the source attribute, so the dependency in ePSA on the
directory is not strictly required.

Question: should ePSA <resolver:Dependency> (specifics below) list the
dependent attribute identifier rather than the LDAP connector?

Can't seem to recreate with aacli.sh

Thanks!
Tom.

attribute-resolver.xml ePSA:

>     <resolver:AttributeDefinition xsi:type="ad:Scoped" id="eduPersonScopedAffiliation" scope="ucdavis.edu" sourceAttributeID="eduPersonAffiliation">
>         <resolver:Dependency ref="ucdLDAP" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName="eduPersonScopedAffiliation" />
>     </resolver:AttributeDefinition>

... and add "member" value to ePA (if it contains any other value):

>     <resolver:AttributeDefinition id="eduPersonAffiliation" xsi:type="ad:Script" sourceAttributeID="eduPersonAffiliation">
>         <resolver:Dependency ref="ucdLDAP" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:eduPersonAffiliation" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" friendlyName="eduPersonAffiliation" />
>         <ad:Script><![CDATA[
>              importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
>              if (eduPersonAffiliation == null) {
>                  eduPersonAffiliation = new BasicAttribute("eduPersonAffiliation");
>              }
>              if (eduPersonAffiliation.getValues().isEmpty() == false) {
>                  eduPersonAffiliation.getValues().add("member");
>              }
>         ]]></ad:Script>
>     </resolver:AttributeDefinition>

And then filter out non-standard (internal legacy) values:

>     <!-- Filter out non-standard attribute values -->
>     <afp:AttributeFilterPolicy id="noRelease">
>         <afp:PolicyRequirementRule xsi:type="basic:ANY" />
>         <afp:AttributeRule attributeID="eduPersonScopedAffiliation">
>             <afp:DenyValueRule xsi:type="basic:AttributeValueString" value="external at ucdavis.edu" ignoreCase="true" />
>         </afp:AttributeRule>
>         <afp:AttributeRule attributeID="eduPersonAffiliation">
>             <afp:DenyValueRule xsi:type="basic:AttributeValueString" value="external" ignoreCase="true" />
>         </afp:AttributeRule>
>     </afp:AttributeFilterPolicy>